Overview

overview

10

Static

static

1

c533034c68...0c.exe

windows7-x64

10

c533034c68...0c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c1ca2ed51b39a0eaf5a1f0938c27213.bin

  • Size

    3.1MB

  • Sample

    230308-bc7h8sdc25

  • MD5

    969e95a5afd798606467a0d8a72bb887

  • SHA1

    f4c51760e6bd6e3e254175e0a0fbb41eaac16651

  • SHA256

    87013c05921d9d97123f110c834aba2b81fae9f7866c0849396b82cc627a12be

  • SHA512

    55c8e8f7fb6d9b9808ec2f1aa0f63180bac34c2916fb3b7b9daf063bef30bb78fd03a2373ce2f2401ee6aa71306f21ea72d2dbc89f9ed70a4b4c5a9634864d7f

  • SSDEEP

    98304:KYcC5w1bnnc6KdgZ6Cr4Zj6eeEsl/28btWoJxJc:KA5+zkhaLE4t5PJw

Score
10/10
aurorastealer

Malware Config

Extracted

Family

aurora

C2

82.115.223.135:8081

Targets

    • Target

      c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe

    • Size

      3.8MB

    • MD5

      1c1ca2ed51b39a0eaf5a1f0938c27213

    • SHA1

      f1398c6185a1e01cab88c9f3d022f6cd43785b8e

    • SHA256

      c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c

    • SHA512

      d7b2b388e2948e2f3e0a2dcf1b098d1e6765ae4d9074eaa8de52da65fc046186087b6426e69a61a6e97aa07662b0918d2ff3bd59214f9d7ceb7d341d6cd4c49a

    • SSDEEP

      49152:e4OuahtPKe0hSRjxv0H0W4Gih7Il3CCJCRhHHcaQlNwQNpJjVRdu:e2rhMj90H27IFCCMNQYQNpvO

    Score
    10/10
    aurorastealer

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks